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IAB Europe’s position: ePrivacy Regulation trilogues 


Overview 


1. 


4. 


IAB Europe (Transparency Register: 43167137250-27) represents the broad digital advertising 
and marketing ecosystem, with 25 national associations whose 5000+ members include 
advertisers, agencies, publishers, and technology companies. We work with over 90 companies 
in our direct membership. 


IAB Europe has been closely following and actively engaging on the ePrivacy Regulation 
proposal’. We welcome the progress achieved by the EU Member States who agreed on a 
negotiation mandate’, recognising it a major milestone toward an updated law. We look 
forward to the prospect of productive trilogue negotiations over the coming months. 


Digital advertising remains the major revenue stream financing Europe’s free and diverse press 
and media. It accounts for 81% of media digital revenues in the Union, enabling citizens to 
access trusted and high-quality content and services’. 


A productive and successful trilogue phase should yield a final text that provides strong privacy 
protections and enables media and other online content and services to continue to rely on an 
advertising revenue stream. In its first reading of the proposal, completed in 20174, the 
European Parliament proposed banning conditional access in a way that would grant users a 
right in law to consume all media and other website content for free, in effect expropriating 
publishers’ work. It should be self-evident that such an approach would undermine the 
sustainability of media and other services that consumers use every day, leading to a race to 
the bottom in relation to information quality and more content and services being moved 
behind paywalls adding to unhealthy polarisation between income groups. It is important that 
the future ePrivacy instrument not result in a fragmented internet that is only partially 
accessible to citizens with limited capacity to pay subscriptions, which users do not want. In 
fact, the latest study confirms that given the choice, an overwhelming majority of Europeans 
(75%) prefer the current commercial model for the internet, which is funded largely by targeted 
advertising, over a scenario where sites and apps fund themselves through subscriptions®. IAB 
Europe hopes that the new Parliament will take a more balanced approach that builds on the 
strong foundation provided by the General Data Protection Regulation (GDPR)°. The adoption 
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https://www.europarl.europa.eu/RegData/docs_autres_institutions/commission_europeenne/com/2017/0010/COM_COM(2017)0010_EN.p 
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A https://data.consilium.europa.eu/doc/document/ST-6087-2021-INIT/en/pdf. 


3 The Economic Contribution of Digital Advertising in Europe, IHS Markit, 2017. 


k https://www.europarl.europa.eu/doceo/document/A-8-2017-0324_EN.html. 
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IAB Europe, What Would an Internet Without Targeted Ads Look Like?, April 2021, https://iabeurope.eu/wp- 


content/uploads/2021/04/IABEurope_What-Would-an-Internet-Without-Targeted-Ads-Look-Like_April-2021.pdf. 


G Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to 
the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection 
Regulation), OJ L 119, 4.5.2016. 
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5. 


of the GDPR was a substantial milestone, establishing the principles of data protection for the 
foreseeable future, including, and indeed explicitly, in the digital advertising context. 


Against this background, we would like to advise on our views in regard to the following: 

a. Consent as a condition for accessing a service - where we support maintaining a clear 
permission for private actors to make access to online services conditional on the well- 
informed consent of the user to data processing for advertising purposes necessary for 
the monetisation model chosen by that service. 


b. Protection of Information on a user's device (‘cookies’) - where we support direct 
recognition of the critical nature of ad-related purposes such as measurement, as well 
as security and fraud prevention, in the final regulation. 


c. Software Privacy Settings - where we support a technology-neutral law that fosters 
competition, enables innovation and avoids requiring utilities such as browsers and 
operating systems to block processing at a technical level. 


Lawmakers should take the necessary time to thoroughly assess and consider any new 
provisions, also bearing in mind experience and observations gained since the GDPR’s 
implementation rather than pursuing expedited adoption of the ePrivacy Regulation. 
Experience with the GDPR has shown the importance of a reasonable transition period of 18-36 
months to afford businesses enough time to assess the new rules and make the necessary 
changes to their privacy policies, products and services, as well as for industry standards to be 
adapted to enable compliant processing. The 24 months’ applicability period agreed by the 
Council should by no means be shortened. 


We encourage EU lawmakers to appreciate the fact that law-making does not take place in a 
vacuum, and that there are real-life business considerations that ought to be taken into account 
when prescribing any new rules affecting the digital advertising and media supply chain. A case 
in point is the current industry-wide reflection on re-architecting digital marketing technology 
amid the demise of 3 party cookies that have long enabled smaller players to compete in the 
market. 


Relevance of the EU privacy & data protection legal framework for the digital ads ecosystem 


8. 


The adoption of the GDPR was a substantial milestone, establishing the principles of data 
protection for the foreseeable future, including in the digital advertising sector. Its scope is 
comprehensive and guarantees the protection of personal data both in the context of electronic 
communication services and information society services. In fact, the GDPR unambiguously 
calls out pseudonymous identifiers (Rec. 26), online identifiers, such as cookies, and device 
identifiers, as examples of personal data (Art. 4(1), Rec. 30). In addition, the GDPR contains rules 
on profiling and provides enhanced rights to users where profiling takes place (Art. 4(4), Art. 22, 
Rec. 72), including where user behaviour is tracked online (Rec. 24). The GDPR also explicitly 
calls out online advertising (Rec. 58). 
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In practice, the mechanics of the digital advertising ecosystem’ are underpinned by the ability 
to process data for advertising-related purposes, including but not limited to delivery and 
measurement of digital advertising. The data processed for such purposes may include IP 
addresses, online advertising identifiers, URLs of sites that users spend time on, information 
about user behaviour on those sites, and indications about the users’ physical whereabouts 
(“geolocation” data)®. Most, or all of these data points are considered to be personal data under 
the GDPR. From this perspective, the EU privacy and data protection legal framework is the 
prime legal regime that the ecosystem players consider to be relevant’. 


Interplay between the GDPR and the ePrivacy instrument 


10. 


11. 


The potential for the GDPR to bring stability is severely undermined by legal uncertainty caused 
by ill-timed legislative initiatives that introduce divergent rules on the same issues. The ePR 
proposal is a case in point. From the very beginning of the ePrivacy Directive review process, 
IAB Europe has been calling on lawmakers to understand the interplay between the ePrivacy 
instrument and the GDPR and focus on aligning the two rather than deviating from the 
principles adopted with the GDPR. 


Misalignment in terms of the lawful grounds for processing available in Art. 6 GDPR and Art. 8.1 
of the proposed ePrivacy Regulation, coupled with lack of reassurance about the ability for 
publishers to make access to online services conditional on the well-informed consent of the 
user to data processing for advertising purposes, will deprive businesses of the flexibility and 
diversity of data processing. It will also eventually put in question the viability of the data-driven 
digital advertising business model, significantly impoverishing the EU media landscape. As 
European publishers are trying to adapt and build more sustainable digital business models 
accessible to all types of audiences, it cannot be reasonably expected that they would switch to 
asubscription-only revenue model. Moreover, an inevitable consequence of the latter would be 
emergence of a two-tier society in which only those citizens who are able to pay for news and 
information will benefit from a rich range of sources, obviously an undesirable development in 
any democratic society. 


Consent as a condition for accessing a service 


12. 


The ePrivacy Regulation must maintain a clear permission for private actors to make access to 
online services conditional on the well-informed consent of the user to data collection and 
processing for advertising purposes. Even if such collection and processing is not strictly 


T There are many different digital advertising models, including but not limited to: ad servers, ad exchanges, SSPs, DSPs, DMPs, ad networks, 
attribution vendors, market research companies, data companies, affiliate marketing companies and cross device vendors. Each digital 
advertising company has its own unique characteristics. That said, in all instances the ecosystem as such relies on the interplay of a variety of 
market participants, from the buy and sell side, from technology and creativity. 


8 For background, the income for publishers and other content providers is increasingly dependent on behavioural targeting instead of non- 
targeted advertising, with 64% of all digital advertising campaigns drawing on some form of behavioural data. What is more, behavioural 
advertising allows publishers to grow digital revenues, with an income for 1000 ad-impressions typically ranging between €1.8 and €25, 
compared to non-targeted between €0.4 and €8. Source: The Economic Value of Behavioural Targeting in Digital Advertising, IHS Markit, 2017, 
available at https://datadrivenadvertising.eu/wp-content/uploads/2017/09/BehaviouralTargeting_FINAL. pdf. 


3 Currently, that regime is the conjunction of the GDPR and the ePrivacy Directive (2002/58/EC), with the former regulating the processing of 
personal data and the latter storage and access of information on a user’s device. 


IAB Europe 
Rond-Point Robert 
Schumanplein 11 
1040 Brussels 


e@ p= 
b: Belgium 
id o jabeurope.eu 


technically necessary for the provision of that service, it remains essential for the monetisation 
model chosen by that service. 
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13. We appreciate the Council’s efforts and progress made in this regard, in particular, in Rec. 
20(aaaa) and Rec. 21(aa), and we encourage lawmakers to build on these. We believe in ad- 
supported media and welcome the explicit recognition of rights for ‘services provided in 
accordance with the freedom of expression and information including for journalistic 
purposes’. At the same time, we observe great diversity of ad-funded content and outlets made 
available to users and submit that all online media are primarily financed through advertising. 
This underscores the importance of so-called conditionality for the continued sustainability of 
online media businesses. 


14. Failing to guarantee these rights would put advertising-funded services on the Internet as we 
know it in jeopardy, result in a steep decrease in the quantity and quality of free services, and/or 
result in the erection of paywalls for previously free services. This is a key concern for the digital 
media and advertising industry as it is a severe interference in a digital media service’s right to 
choose its own business model and to determine the terms under which it makes its service 
available to consumers. Such an interference touches on the fundamental right to property and 
the freedom to conduct business, which must be considered and carefully balanced with the 
fundamental right to privacy and data protection that the ePrivacy Regulation attempts to 
protect. 


15. IAB Europe believes that online services should be allowed necessary flexibility, to ensure they 
are able to continue providing free, data-driven advertising-funded offerings. Requiring them 
to provide an ‘equivalent’ offer is constraining, whereas recognising that ‘similar’ or 
‘alternative’ offers by other providers could prove more effective in light of the framing of the 
Recital 20(aaaa) language of the Council’s mandate. 


16. IAB Europe’s Transparency & Consent Framework (TCF) was created to facilitate legal 
compliance with the GDPR and existing ePrivacy Directive. It is an industry standard that aims 
to help companies ensure that where personal data is processed in connection with the delivery 
and measurement of advertisements or the personalisation of editorial content, consumers as 
well as industry stakeholders benefit from transparency and control. 


Protection of Information on a user's device ('cookies') 


17. Ad-related data collection and processing purposes such as measurement, security and fraud 
prevention are critical for the functioning of ad-funded models. 


18. As on any other media platform (e.g., TV, radio, print), collaboration with independent third- 
party service providers is essential to achieve effective and comparable measurement of reach 
and ad performance. Without it, advertising is of little value to the advertiser. Measurement 
functions are particularly important for small and medium sized enterprises that cannot rely on 


10 www.iabeurope.eu/tcf. 
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large audiences on their own individual site. Relevant Art. 8 provisions must enable the variety 
of market constellations through which these services are provided. 


Software Privacy Settings 


19. 


20. 


21. 


22. 


23. 


IAB Europe believes in law that is technology neutral and allows companies to innovate. In the 
digital advertising context, it translates into a dynamic future in which advertisers, publishers 
and consumers have a wide range of paradigms and suppliers from which to choose. 
Consequently, we object to any provisions mirroring the reading of the original Article 10 on 
software privacy settings. 


Allowing users to express their consent on a general basis arguably does not meet the specificity 
requirement of consent under the GDPR, this means users would still face specific consent 
requests in addition to the general consent of the software layer. 


Where processing is based on consent it is important that legislation does not dictate which 
technologies must be used to do so, as to not unnecessarily inhibit innovation around providing 
information and requesting consent in the most appropriate fashion. 


Mandating browsers or operating systems to block processing at a technical level will deprive 
media and other ad-funded digital properties of their relationship with end-users to explain the 
terms on which their products and services are placed on the market, and deny them the 
responsibility for obtaining the end-users’ consent. Meanwhile, user experience will be 
hampered, and many websites will become inaccessible. We believe in a paradigm where the 
user would have actual freedom to make decisions on their own and practically be able to 
change the previously configured software settings. 


The absence of Article 10 verbatim may still be obfuscated by similar language, such as in Article 
4.2 and Recital 20a in the Council text, which in practice reinstates the removed Article 10 
provision. 


